Cyware Orchestrate

Fetch Blocklists

This action returns the various blocklist items.

Create Blocklist Item

This action creates a new blocklist item.

Remove Blocklist Item

This action deletes a blocklisted item with the help of its unique ID.

Fetch Configured Domain

This action returns the various blocklist items.

Create Domain Item

This action creates a new domain item.

Remove Domain Item

This action deletes a domain item using a unique ID.

Get Allow List

This action retrieves an allowed list.

Search Detections

This action performs a search operation on detections.

Search Mailtrace

This action performs a search operation on emails.

Create New Allowlist Item

This action creates an allow list item.

Remove Allowlist Item

This action deletes an allow list item.

Generic Action

This is a generic action to perform any additional use case that you want on the Area 1 Security application.

Download Email

This action retrieves the content of an email from the detection message sent from the Area1 app.

Username

Enter the username.

Text

Required

Password

Enter the password.

Password

Required

Pattern

Enter a pattern as an email or a regular expression.

Example:

"sample@sampleemail.com"

Text

Required

Comments

Enter an optional comment associated with the pattern.

Text

Optional

proxy_port

Number

The proxy port number. Example: -1

require_tls_inbound

Boolean

Indicates if TLS is required for inbound communication. Example: false

comments

String

A comment or note associated with the entry, if available.

require_tls

Boolean

Indicates if TLS is required. Example: false

is_primary

Boolean

Indicates if this is the primary entry. Example: false

drop_dispositions

String

A set of conditions under which emails should be dropped. Example: "{MALICIOUS,MALICIOUS-BEC,SPAM}"

created_at

String

Creation date of the entry in RFC 2822 format. Example: "Fri, 25 Feb 2022 20:59:18 GMT"

transport

String

The transport mechanism used, if specified.

deleted_at

String

Date of deletion in RFC 2822 format or "Thu, 01 Jan 1970 00:00:00 GMT" if not deleted. Example: "Thu, 01 Jan 1970 00:00:00 GMT"

reject_type

String

Type of rejection mechanism used. Example: "HARD"

require_tls_outbound

Boolean

Indicates if TLS is required for outbound communication. Example: `false`

dmarc_enforcement

String

DMARC enforcement level. Example: "PROMOTE"

domain

String

The domain associated with the settings. Example: "example.com"

id

Number

A unique identifier for the domain settings. Example: 1576

lookback_hops

Number

The number of hops to look back for inspection. Example: `1`

customer_id

String

A unique identifier for the customer associated with the entry. Example: "1b8183fa-15cd-471b-90bb-68fffb575d6f"

o365_tenant_id

The Microsoft Office 365 tenant ID, if applicable.

dmarc_report_enabled

Boolean

Indicates if DMARC reporting is enabled. Example: true

last_modified

String

Date of the last modification in RFC 2822 format. Example: "Fri, 25 Feb 2022 20:59:18 GMT"

Blocklist Item ID

Enter the unique ID associated with blocklisted item. Example:

"85546"

Text

Required

This is retrieved using the Create Blocklist Item action.

Domain

Enter a domain.

Example:

"google.com"

Text

Required

Domain item ID

Enter the unique ID associated with the domain item. Example:

"6525"

Text

Required

This is retrieved using the Create Domain Item action.